KR20040001026A - Device to prevent IP address spoofing and method thereof - Google Patents

Abstract

PURPOSE: An apparatus for preventing the falsification of an IP(Internet Protocol) address and a method therefor are provided to block that a hacker falsifies an address by preventing the source address falsification of a packet transmitted from a subscriber in a subscriber connection router. CONSTITUTION: A packet address extracting unit(301) extracts a source address included in a packet transmitted from a subscriber network. A network address extracting unit(302) extracts a network address managed by a router(12). A network address mapping unit(303) maps a network address portion of the source address of the packet to the network address managed by the router(12). A packet transmitting unit(304) transmits the mapped packet to the outside.

Description

Device to prevent IP address spoofing and method

The present invention relates to an apparatus for preventing IP address tampering, and more particularly, to an apparatus and method for preventing IP address tampering, which prevents an attacker's address from being tampered with, by preventing an attacker from tampering with an IP address. It is about.

Denial of Service (DOS) attacks on the Internet are a major problem. DOS is an attack method that can occur in operating systems that support multi-tasking. Hogging, using up, or destroying a system's resources can make it impossible for the system to provide the right services to other users.

Although DOS does not pose a serious problem to the system (such as gaining root privileges, destroying or tampering with system or user data), it can cause a lot of inconvenience to users by causing problems with the system's normal performance (paralysis of network or system services). do.

Therefore, system administrators should be able to quickly detect if a DOS accidental error occurred and resolve the problem quickly so that they can provide appropriate services to users.

In particular, since DOS is caused by an attacker altering its address, it is difficult to solve the problem quickly by tracking the source of the attack. In order to solve this problem, a method of analyzing a source address in a subscriber access router and performing a blocking action on a modulated packet has been proposed.

Specifically, when a subscriber generates a packet to transmit and transmits it to a subscriber access router, the subscriber access router extracts a source address from the packet and compares the jurisdiction IP address group with the source address. As a result, if the source address of the packet is not included in the jurisdiction IP address group, the packet is discarded. If the source address of the packet is included in the jurisdiction IP address group, the packet is transmitted to the destination.

For example, if a hacker modulates a packet with a source address of 123.4.5.6 and a source address of 123.4.5.7, if the modulated address 123.4.5.7 is an address within the jurisdiction IP address family, the packet is sent to the destination. If address 123.4.5.7 is not an address within the jurisdiction of the IP address family, then discard the packet.

That is, if the modulated address of a packet sent to a routing that manages IP addresses 123.4.5.1 through 123.4.5.9 is 123.4.4.1, then the address is not in the jurisdiction IP address family managed by the routing. Discard.

However, if a hacker has forged a source address into an address in the jurisdiction IP address family, the tampered packet cannot be found and discarded. That is, if the modulated address of a packet sent to a routing that manages IP addresses 123.4.5.1 through 123.4.5.9 is 123.4.4.2, then the address is in the jurisdiction IP address family managed by the routing. It is sent to the destination as it is.

As such, a method of blocking address modulation by analyzing a source address in a router to which a subscriber accesses and discarding a packet having a modulated address is widely used. However, this method applies filtering to a router. May degrade performance.

In addition, since packets modified to addresses within the jurisdiction's IP address family cannot be found and thus are not a way to prevent accurate IP address tampering, the original address forgery cannot be prevented. There is a problem that it is difficult to trace the attack source.

Therefore, the conventional method for preventing IP address tampering has a partial effect by discarding the modulated packet, but does not provide an effect of preventing fundamental IP address tampering.

An object of the present invention for solving the above problems is to prevent an attacker from tampering with an address by preventing the source address of the packet transmitted from the subscriber in the subscriber access router.

1 is a diagram illustrating a network for general packet transmission

Figure 2 is a block diagram showing a preferred embodiment of the IP address tamper resistant apparatus according to the present invention

3 is a flowchart illustrating operation of an embodiment according to the present invention.

An apparatus for preventing IP address tampering of a packet transmitted to a destination of the Internet through a router in a subscriber network according to the present invention includes: a packet address extractor for extracting a source address included in a packet transmitted from the subscriber network; A network address extraction unit for extracting a network address, a network address mapping unit for mapping the network address portion of the source address of the packet to a network address managed by the router, and a packet transmission unit for transmitting the mapped packet to the outside do.

And, according to the present invention, the first step of extracting the source address of the packet generated in the subscriber network, the second step of extracting the interface network address of the router managing the subscriber network, the network address of the source address of the packet A third step of mapping a portion to a network address managed by the router and a fourth step of transmitting the mapped packet to a destination are performed.

The above and other objects and features and advantages of the present invention will become more apparent from the following detailed description taken in conjunction with the accompanying drawings.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram showing a network for a general packet transmission, showing that the subscriber network is connected to the Internet through a router.

When the user of the subscriber network 10 generates the packet and the router 12 transmits the packet to the destination router connected to the Internet 14, the packet is delivered from the destination router to the corresponding destination address.

The router 12 is a network device that connects a LAN and a LAN or a LAN and a WAN, and connects several independent networks that are physically separated from each other, and establishes an optimal path for transmitting a packet to a destination with an IP address.

The router 12 compares the destination address and the subnet mask, the source IP address and the subnet mask of the forwarded packet with each other to determine whether to forward the packet to the local network or to route to the external network through the router serial interface as the default gateway. More specifically, the router 12 may set the optimal route between numerous network segments and forward the packet, or may determine the degree and route of each network traffic and set a detour route for the heavy traffic route. By determining the number of hops (HOP), which is the number of routers 12 passing between network segments, a path for transmitting data is determined.

The router according to the present invention has a configuration as shown in FIG. 2 in order to prevent a DOS attacker from attacking by modifying its address.

The router 12 may include a packet address extractor 301 for extracting a source address included in a packet transmitted from the subscriber network 10, a network address extractor 302 for extracting a network address managed by the router, and a source address. A network address mapping unit 303 for mapping the network address portion to a network address managed by the router, and a packet transmitter 304 for transmitting the mapped packet to the outside.

Accordingly, the IP address modulation prevention for the packet transmitted in the subscriber network 10 as shown in FIG.

First, a packet including a message to be transmitted in the subscriber network 10 is generated. The packet includes a source port number, a destination port number, a subnet number, a network number, and is transmitted to the router 12 managing the subscriber network 10.

The router 12 extracts the source address (subscriber's IP address) included in the head of the packet from the packet address extraction unit 301 (S201). In addition, the network address extraction unit 302 extracts the network address for the router interface that the packet came in (S202).

Thereafter, the network address of the router interface is inserted into the network address portion of the source address extracted from the network address mapping unit 303 (S203).

The packet transmitter 304 transmits a packet including the network address of the router interface to the destination.

Therefore, even if an attack packet is transmitted in which the source address is modified for the purpose of attack, since the network address mapping of the router interface is performed at the subscriber access router, the modified packet has the original source network address. Therefore, according to the present invention, the source of various hacking attacks can be traced when the IP is tampered with, thereby preventing hacking.

As described above, the method for preventing IP address tampering according to the present invention can effectively prevent an attacker's IP address tampering by applying the device to a subscriber access router in a network operator or a general enterprise. The source can be traced accurately, and ultimately, it can prevent hacking crimes.

In addition, a preferred embodiment of the present invention is for the purpose of illustration, those skilled in the art will be able to various modifications, changes, substitutions and additions through the spirit and scope of the appended claims, such modifications and changes are the following claims It should be seen as belonging to a range.

Claims (2)

A device for preventing IP address tampering of packets transmitted from a subscriber network to a destination on the Internet through a router, A packet address extraction unit for extracting a source address included in a packet transmitted from the subscriber network; A network address extracting unit extracting a network address managed by the router; A network address mapping unit for mapping the network address portion of the source address of the packet to a network address managed by the router; And And a packet transmitter for transmitting the mapped packet to the outside. Extracting a source address of a packet generated in a subscriber network; Extracting an interface network address of a router managing a subscriber network; A third step of mapping the network address portion of the source address of the packet to a network address managed by the router; And transmitting the mapped packet to a destination. 4.